openship 0.7.0 → 0.7.2

package/dist/{chunk-TPGBT5UR.js → chunk-EXXKRORU.js}

@@ -9,11 +9,11 @@ import {
   prepareSourceTree,
   resolveDockerBuildArgs,
   resolveServiceDockerfile
-} from "./chunk-QNQFS37A.js";
+} from "./chunk-S5GU345P.js";
 import {
   isArtifactPathRef,
   removeManagedArtifact
-} from "./chunk-MZYD3LFP.js";
+} from "./chunk-AMADTKC6.js";
 import {
   BuildCancelledError,
   BuildLogger,
@@ -35,7 +35,7 @@ import {
   sq,
   staticBuilderOutputPath,
   transferLocalDirectory
-} from "./chunk-SYQ3FOLE.js";
+} from "./chunk-IVMPA6RC.js";
 import {
   DOCKER_DIAL_STDIO_COMMAND,
   attachDialStdioDiagnostics,
@@ -44,17 +44,17 @@ import {
   execSshCommand,
   openDockerDialStdioChannel,
   openSshUnixSocket
-} from "./chunk-HBQWOJRP.js";
+} from "./chunk-TKK5NPDQ.js";
 import {
   dirOf,
   ensureOwnedDir
-} from "./chunk-JWW5YAFL.js";
+} from "./chunk-B2BQX6JX.js";
 import {
   OPENSHIP_LABEL
-} from "./chunk-CMGRMPRQ.js";
+} from "./chunk-7TQP6723.js";
 import {
   isRuntimeNotFoundError
-} from "./chunk-N5YZMO33.js";
+} from "./chunk-L4DRH6ZA.js";
 import {
   formatCpuCores,
   formatMemoryMb,
@@ -65,7 +65,7 @@ import {
   registryForImage,
   safeErrorMessage,
   withTimeout
-} from "./chunk-IVRTIKNZ.js";
+} from "./chunk-COI4VFRW.js";
 import {
   __commonJS,
   __require,
@@ -4627,6 +4627,7 @@ var require_tar_fs = __commonJS({
 // ../../packages/adapters/src/runtime/docker.ts
 var tarFs = __toESM(require_tar_fs(), 1);
 import Dockerode from "dockerode";
+import { randomUUID } from "crypto";
 import { createGzip } from "zlib";
 import { PassThrough, Writable } from "stream";
 import { relative, sep } from "path";
@@ -5630,6 +5631,247 @@ function resolveDockerTransport(opts) {
   };
 }
 
+// ../../packages/adapters/src/runtime/docker-build-diagnostics.ts
+var DEFAULT_DOCKER_BUILD_IDLE_TIMEOUT_MS = 10 * 6e4;
+var MIN_DOCKER_BUILD_IDLE_TIMEOUT_MS = 6e4;
+var MAX_DOCKER_BUILD_IDLE_TIMEOUT_MS = 24 * 60 * 6e4;
+function getDockerBuildIdleTimeoutMs(raw = process.env.OPENSHIP_BUILD_IDLE_TIMEOUT_MS) {
+  if (raw == null || raw.trim() === "") return DEFAULT_DOCKER_BUILD_IDLE_TIMEOUT_MS;
+  const value = Number(raw);
+  return Number.isSafeInteger(value) && value >= MIN_DOCKER_BUILD_IDLE_TIMEOUT_MS && value <= MAX_DOCKER_BUILD_IDLE_TIMEOUT_MS ? value : DEFAULT_DOCKER_BUILD_IDLE_TIMEOUT_MS;
+}
+function memoryGuidance(context) {
+  const memoryMb = context.configuredMemoryMb;
+  if (context.memoryLimitApplied && memoryMb && memoryMb > 0) {
+    return `The classic Docker builder was capped at ${memoryMb} MB RAM; raise Build Memory in Project Settings \u2192 Resources if this build needs more.`;
+  }
+  return "This build path was not under an OpenShip-enforced memory cap; check available RAM/swap and the host or Docker daemon OOM logs.";
+}
+function findNonZeroExitCode(output) {
+  for (const match of output.matchAll(
+    /(?:returned a non-zero code|exit(?:ed)? with(?: exit)? code|exit code)\s*:?\s*(\d+)\b/gi
+  )) {
+    const code = Number(match[1]);
+    if (code !== 0) return code;
+  }
+  return null;
+}
+function extractDockerBuildFailureHint(line, context = {}) {
+  const code = findNonZeroExitCode(line);
+  if (code === 137) {
+    return `${line} \u2014 The build process was killed by SIGKILL (exit code 137). Memory exhaustion is the most common cause, but exit 137 alone does not prove OOM. ${memoryGuidance(context)}`;
+  }
+  if (code === 143) {
+    return `${line} \u2014 The build process received SIGTERM (exit code 143), usually because it was cancelled or stopped by another supervisor.`;
+  }
+  if (code !== null) return line;
+  if (/JavaScript heap out of memory|Fatal process out of memory|Ineffective mark-compacts near heap limit|Reached heap limit Allocation failed|fatal error:\s*(?:runtime:\s*)?out of memory/i.test(
+    line
+  )) {
+    return `${line} \u2014 The build process explicitly reported that it ran out of memory. ${memoryGuidance(context)}`;
+  }
+  if (/\bENOMEM\b|cannot allocate memory/i.test(line)) {
+    return `${line} \u2014 The build process could not allocate memory (ENOMEM). ${memoryGuidance(context)}`;
+  }
+  return null;
+}
+function chooseDockerBuildFailureHint(current, candidate) {
+  if (!candidate) return current;
+  if (!current) return candidate;
+  const score = (message) => {
+    if (/explicitly reported that it ran out of memory|could not allocate memory/i.test(message)) {
+      return 4;
+    }
+    if (/SIGKILL \(exit code 137\)/i.test(message)) return 3;
+    if (/BuildKit|package\.json was not found/i.test(message)) return 2;
+    if (/returned a non-zero code|failed to solve|executor failed running|error: build/i.test(message)) {
+      return 1;
+    }
+    return 0;
+  };
+  return score(candidate) > score(current) ? candidate : current;
+}
+function dockerBuildExitMessage(code, streamedHint, context = {}) {
+  if (streamedHint) return streamedHint;
+  const plain = `docker build exited with code ${code}`;
+  return extractDockerBuildFailureHint(plain, context) ?? plain;
+}
+function formatDuration(ms) {
+  if (ms % 6e4 === 0) {
+    const minutes = ms / 6e4;
+    return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+  }
+  const seconds = Math.ceil(ms / 1e3);
+  return `${seconds} second${seconds === 1 ? "" : "s"}`;
+}
+function dockerBuildIdleTimeoutError(timeoutMs, context = {}) {
+  const limit = context.memoryLimitApplied && context.configuredMemoryMb && context.configuredMemoryMb > 0 ? ` The classic Docker builder was capped at ${context.configuredMemoryMb} MB RAM, so sustained memory pressure is one possible cause.` : "";
+  return new Error(
+    `Docker build produced no output for ${formatDuration(timeoutMs)} and was cancelled.${limit} Other common causes are package-registry or DNS failures, a process waiting for input, and a stalled Docker daemon.`
+  );
+}
+function startDockerBuildIdleMonitor(options) {
+  let stopped = false;
+  let lastProgressAt = Date.now();
+  let lastReportedMinute = 0;
+  let deadline;
+  const armDeadline = () => {
+    clearTimeout(deadline);
+    deadline = setTimeout(() => {
+      if (stopped) return;
+      stopped = true;
+      clearInterval(heartbeat);
+      options.onTimeout();
+    }, options.timeoutMs);
+    deadline.unref?.();
+  };
+  const heartbeat = setInterval(() => {
+    if (stopped) return;
+    const idleMs = Date.now() - lastProgressAt;
+    const idleMinutes = Math.floor(idleMs / 6e4);
+    if (idleMinutes > lastReportedMinute) {
+      lastReportedMinute = idleMinutes;
+      options.onIdle(idleMs);
+    }
+  }, 6e4);
+  heartbeat.unref?.();
+  armDeadline();
+  return {
+    progress() {
+      if (stopped) return;
+      lastProgressAt = Date.now();
+      lastReportedMinute = 0;
+      armDeadline();
+    },
+    stop() {
+      if (stopped) return;
+      stopped = true;
+      clearTimeout(deadline);
+      clearInterval(heartbeat);
+    }
+  };
+}
+
+// ../../packages/adapters/src/runtime/docker-build-container-tracker.ts
+function normalizedImageId(value) {
+  return (value ?? "").replace(/^sha256:/, "").toLowerCase();
+}
+function commandMatches(instruction, actual) {
+  const run = instruction.match(/^RUN\s+([\s\S]+)$/i)?.[1]?.trim();
+  if (!run || !actual?.length) return false;
+  if (run.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(run);
+      return Array.isArray(parsed) && parsed.every((part) => typeof part === "string") && parsed.length === actual.length && parsed.every((part, index) => part === actual[index]);
+    } catch {
+      return false;
+    }
+  }
+  return actual[actual.length - 1] === run;
+}
+var LegacyBuildContainerTracker = class {
+  constructor(client, expectedMemoryBytes, ownershipHost) {
+    this.client = client;
+    this.expectedMemoryBytes = expectedMemoryBytes;
+    this.ownershipHost = ownershipHost;
+  }
+  parentImageId = null;
+  pendingStep = null;
+  active = null;
+  expectedStepTotal = null;
+  lastStepNumber = 0;
+  chunkBuffer = "";
+  queue = Promise.resolve();
+  termination = null;
+  /** Consume one complete dockerode `event.stream` field. */
+  observe(stream) {
+    if (!stream) return;
+    for (const rawLine of stream.split(/\r?\n/)) {
+      this.enqueueLine(rawLine);
+    }
+  }
+  /** Consume an arbitrary SSH stdout/stderr chunk, retaining a partial line. */
+  observeChunk(chunk) {
+    if (!chunk) return;
+    const parts = `${this.chunkBuffer}${chunk}`.split(/\r\n|\n|\r/);
+    this.chunkBuffer = parts.pop() ?? "";
+    if (this.chunkBuffer.length > 8192) this.chunkBuffer = this.chunkBuffer.slice(-8192);
+    for (const line of parts) this.enqueueLine(line);
+  }
+  flush() {
+    this.enqueueLine(this.chunkBuffer);
+    this.chunkBuffer = "";
+  }
+  enqueueLine(rawLine) {
+    const line = rawLine.trim();
+    if (!line) return;
+    this.queue = this.queue.then(
+      () => this.observeLine(line),
+      () => this.observeLine(line)
+    );
+  }
+  async observeLine(line) {
+    if (this.active) {
+      const removed = line.match(/^---> Removed intermediate container\s+([a-f0-9]{12,64})$/i);
+      if (removed?.[1]?.toLowerCase() === this.active.id) {
+        try {
+          const info = await this.client.inspect(this.active.id);
+          if (!info?.State?.Running) this.active = null;
+        } catch {
+        }
+      }
+      return;
+    }
+    const layer = line.match(/^--->\s+([a-f0-9]{12,64})$/i);
+    if (layer?.[1]) {
+      this.parentImageId = layer[1].toLowerCase();
+      return;
+    }
+    const step = line.match(/^Step\s+(\d+)\/(\d+)\s*:\s*([\s\S]+)$/i);
+    if (step?.[1] && step[2] && step[3]) {
+      const number = Number(step[1]);
+      const total = Number(step[2]);
+      const firstStep = this.lastStepNumber === 0 && number === 1;
+      const nextStep = number === this.lastStepNumber + 1;
+      const sameTotal = this.expectedStepTotal === null || total === this.expectedStepTotal;
+      if (number >= 1 && total >= number && sameTotal && (firstStep || nextStep)) {
+        this.expectedStepTotal ??= total;
+        this.lastStepNumber = number;
+        this.pendingStep = {
+          number,
+          total,
+          instruction: step[3].trim(),
+          parentImageId: this.parentImageId
+        };
+      }
+      return;
+    }
+    const running = line.match(/^---> Running in\s+([a-f0-9]{12,64})$/i);
+    if (running?.[1] && this.pendingStep && /^RUN\s+/i.test(this.pendingStep.instruction)) {
+      this.active = { ...this.pendingStep, id: running[1].toLowerCase() };
+      this.pendingStep = null;
+    }
+  }
+  async terminate() {
+    await this.queue;
+    const candidate = this.active;
+    if (!candidate) return { status: "none" };
+    const info = await this.client.inspect(candidate.id);
+    if (!info?.State?.Running) return { status: "not-running", id: candidate.id };
+    const actualId = info.Id?.toLowerCase() ?? "";
+    const actualImage = normalizedImageId(info.Config?.Image);
+    const expectedMemory = this.expectedMemoryBytes ?? 0;
+    const ownershipEntry = `${this.ownershipHost}:127.0.0.1`;
+    const verified = actualId.startsWith(candidate.id) && candidate.parentImageId !== null && actualImage.startsWith(candidate.parentImageId) && (info.HostConfig?.Memory ?? 0) === expectedMemory && info.HostConfig?.ExtraHosts?.includes(ownershipEntry) === true && commandMatches(candidate.instruction, info.Config?.Cmd);
+    if (!verified) return { status: "unverified", id: candidate.id };
+    await this.client.kill(candidate.id);
+    return { status: "killed", id: candidate.id };
+  }
+  terminateActive() {
+    return this.termination ??= this.terminate();
+  }
+};
+
 // ../../packages/adapters/src/runtime/docker.ts
 var isDockerNotFoundError = isRuntimeNotFoundError;
 function ownsBuiltImage(imageRef) {
@@ -5647,7 +5889,42 @@ var RESTART_POLICIES = {
   "unless-stopped": { Name: "unless-stopped", MaximumRetryCount: 0 },
   no: { Name: "no", MaximumRetryCount: 0 }
 };
-var DOCKER_BUILD_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+var BUILD_CONTAINER_CLEANUP_TIMEOUT_MS = 5e3;
+var BUILD_CONTAINER_IDENTIFICATION_GRACE_MS = 500;
+function newBuildOwnershipHost() {
+  return `openship-build-${randomUUID()}.invalid`;
+}
+async function boundedBuildContainerCleanup(cleanup) {
+  let timer = null;
+  const guarded = cleanup.catch(() => null);
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(null), BUILD_CONTAINER_CLEANUP_TIMEOUT_MS);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([guarded, deadline]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function stopTrackedBuildContainer(tracker, log, reason) {
+  if (!tracker) return;
+  tracker.flush();
+  const cleanup = await boundedBuildContainerCleanup(tracker.terminateActive());
+  if (cleanup?.status === "killed") {
+    log.log(`Stopped ${reason} Docker build container ${cleanup.id.slice(0, 12)}.`);
+  } else if (cleanup?.status === "unverified") {
+    log.log(
+      `${reason === "timed-out" ? "Timed-out" : "Interrupted"} build container ${cleanup.id.slice(0, 12)} did not match this build's verified step; it was left untouched.`,
+      "warn"
+    );
+  } else if (cleanup === null) {
+    log.log(
+      `${reason === "timed-out" ? "Timed-out" : "Interrupted"} Docker build cleanup could not be confirmed within 5 seconds; Docker may still be releasing the build container.`,
+      "warn"
+    );
+  }
+}
 var activeDockerBuilds = /* @__PURE__ */ new Map();
 var pendingDockerBuildCancellations = /* @__PURE__ */ new Map();
 var PENDING_CANCEL_TTL_MS = 10 * 60 * 1e3;
@@ -5817,21 +6094,34 @@ function parsePortBindings(portSpecs) {
 }
 function packBuildContext(contextDir, entries, cancelSignal, ignoreContextPath) {
   const controller = new AbortController();
+  const abort = (reason) => {
+    if (!controller.signal.aborted) controller.abort(reason);
+  };
   const ignore = ignoreContextPath ? (absolutePath) => ignoreContextPath(relative(contextDir, absolutePath).split(sep).join("/")) : void 0;
   const pack2 = tarFs.pack(contextDir, { entries, ignore });
   const body = pack2.pipe(createGzip());
   let contextError = null;
   const capture = (err) => {
     contextError ??= err instanceof Error ? err : new Error(String(err));
-    if (!controller.signal.aborted) controller.abort();
+    abort(contextError);
   };
+  const onCancel = () => abort(cancelSignal?.reason);
   if (cancelSignal) {
-    if (cancelSignal.aborted) controller.abort();
-    else cancelSignal.addEventListener("abort", () => controller.abort(), { once: true });
+    if (cancelSignal.aborted) abort(cancelSignal.reason);
+    else cancelSignal.addEventListener("abort", onCancel, { once: true });
   }
   pack2.once("error", capture);
   body.once("error", capture);
-  return { body, abortSignal: controller.signal, takeError: () => contextError };
+  return {
+    body,
+    abortSignal: controller.signal,
+    abort,
+    // Once buildImage has returned the response stream, streamDockerodeBuild
+    // owns cancellation. It briefly keeps that stream alive to receive Docker's
+    // exact intermediate-container id before aborting the request.
+    detachCancellation: () => cancelSignal?.removeEventListener("abort", onCancel),
+    takeError: () => contextError
+  };
 }
 var DURATION_UNITS_NS = {
   ns: 1,
@@ -6179,19 +6469,25 @@ var DockerRuntime = class _DockerRuntime {
     logger.log(`[${step}] ${label} ${message}`);
     logger.step(step, status, message);
   }
-  handleBuildEvent(event, logger, trace) {
-    const errorMessage = event.errorDetail?.message ?? event.error;
+  handleBuildEvent(event, logger, trace, diagnosticContext = {}) {
+    const errorMessage = event.errorDetail?.message || event.error;
     if (errorMessage) {
       logger.log(errorMessage, "error");
-      return errorMessage;
+      return {
+        errorMessage,
+        failureHint: this.extractBuildFailureHint(errorMessage, diagnosticContext) ?? errorMessage
+      };
     }
     if (event.id === "moby.buildkit.trace" && typeof event.aux === "string") {
       let hint = null;
       for (const line of trace?.push(event.aux) ?? []) {
         logger.log(line.message, line.level === "error" ? "error" : parseLogLevel(line.message));
-        hint ??= this.extractBuildFailureHint(line.message);
+        hint = chooseDockerBuildFailureHint(
+          hint,
+          this.extractBuildFailureHint(line.message, diagnosticContext) ?? (line.level === "error" ? line.message : null)
+        );
       }
-      return hint;
+      return { failureHint: hint };
     }
     if (event.stream) {
       const line = event.stream.trim();
@@ -6216,7 +6512,7 @@ var DockerRuntime = class _DockerRuntime {
         return null;
       }
       logger.log(line, parseLogLevel(line));
-      return this.extractBuildFailureHint(line);
+      return { failureHint: this.extractBuildFailureHint(line, diagnosticContext) };
     }
     if (event.status) {
       const parts = [event.id, event.status, event.progress].filter((p) => Boolean(p?.trim())).map((p) => p.trim());
@@ -6245,10 +6541,9 @@ var DockerRuntime = class _DockerRuntime {
   isLowSignalDockerLine(line) {
     return _DockerRuntime.DOCKER_BUILDER_NOISE.some((p) => p.test(line));
   }
-  extractBuildFailureHint(line) {
-    if (/returned a non-zero code:\s*\d+/i.test(line)) {
-      return line;
-    }
+  extractBuildFailureHint(line, diagnosticContext = {}) {
+    const processFailure = extractDockerBuildFailureHint(line, diagnosticContext);
+    if (processFailure) return processFailure;
     if (/requires? BuildKit|BuildKit is enabled but the buildx component/i.test(line)) {
       return `${line} \u2014 this Dockerfile needs BuildKit. Install the docker buildx plugin on the build host (\`docker-buildx-plugin\`), or remove the BuildKit-only instruction.`;
     }
@@ -6345,7 +6640,8 @@ var DockerRuntime = class _DockerRuntime {
     const dockerfileFlag = dockerfileName && dockerfileName !== "Dockerfile" ? ` -f ${sq(dockerfileName)}` : "";
     const buildKit = await this.remoteBuildKitAvailable();
     const builderEnv = buildKit ? "DOCKER_BUILDKIT=1 " : "";
-    const builderFlags = buildKit ? " --progress=plain" : " --force-rm";
+    const ownershipHost = buildKit ? null : newBuildOwnershipHost();
+    const builderFlags = buildKit ? " --progress=plain" : ` --force-rm --add-host ${sq(`${ownershipHost}:127.0.0.1`)}`;
     if (buildKit) {
       log.log("Builder: BuildKit (docker buildx detected on the host)");
     } else if (opts?.requiresBuildKit) {
@@ -6369,16 +6665,79 @@ var DockerRuntime = class _DockerRuntime {
       "running",
       "Running install inside container (docker build)"
     );
-    const { code } = await executor.streamExec(
-      buildCmd,
-      (entry) => {
-        log.log(entry.message, parseLogLevel(entry.message));
+    const diagnosticContext = {
+      configuredMemoryMb: config.resources.memoryMb,
+      memoryLimitApplied: false
+    };
+    const buildContainerTracker = buildKit ? null : this.remoteLegacyBuildContainerTracker(executor, ownershipHost);
+    const commandAbort = new AbortController();
+    const forwardCancellation = () => {
+      buildContainerTracker?.flush();
+      if (buildContainerTracker) void buildContainerTracker.terminateActive();
+      commandAbort.abort(signal?.reason);
+    };
+    if (signal?.aborted) forwardCancellation();
+    else signal?.addEventListener("abort", forwardCancellation, { once: true });
+    let timeoutError = null;
+    let streamedFailureHint = null;
+    const timeoutMs = getDockerBuildIdleTimeoutMs();
+    const idleMonitor = startDockerBuildIdleMonitor({
+      timeoutMs,
+      onIdle: (idleMs) => {
+        log.log(`Still building... (no output for ${Math.floor(idleMs / 6e4)}m)`);
       },
-      { signal }
-    );
+      onTimeout: () => {
+        timeoutError = dockerBuildIdleTimeoutError(timeoutMs, diagnosticContext);
+        buildContainerTracker?.flush();
+        if (buildContainerTracker) void buildContainerTracker.terminateActive();
+        commandAbort.abort(timeoutError);
+      }
+    });
+    let code = null;
+    let execError = null;
+    try {
+      const result = await executor.streamExec(
+        buildCmd,
+        (entry) => {
+          idleMonitor.progress();
+          buildContainerTracker?.observeChunk(entry.message);
+          streamedFailureHint = chooseDockerBuildFailureHint(
+            streamedFailureHint,
+            this.extractBuildFailureHint(entry.message, diagnosticContext)
+          );
+          log.log(entry.message, parseLogLevel(entry.message));
+        },
+        { signal: commandAbort.signal }
+      );
+      code = result.code;
+    } catch (error) {
+      execError = error;
+    } finally {
+      idleMonitor.stop();
+      buildContainerTracker?.flush();
+      signal?.removeEventListener("abort", forwardCancellation);
+    }
     log.log("\u2500\u2500\u2500 end docker build output \u2500\u2500\u2500");
-    if (signal?.aborted) throw new BuildCancelledError();
-    if (code !== 0) throw new Error(`docker build exited with code ${code}`);
+    if (timeoutError) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "timed-out");
+      throw timeoutError;
+    }
+    if (signal?.aborted) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw new BuildCancelledError();
+    }
+    if (execError) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw execError;
+    }
+    if (code === null) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw new Error("docker build ended without an exit code");
+    }
+    if (code !== 0) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw new Error(dockerBuildExitMessage(code, streamedFailureHint, diagnosticContext));
+    }
     this.emitDockerStep(log, "install", "completed", "Image build finished");
   }
   /**
@@ -6607,6 +6966,55 @@ var DockerRuntime = class _DockerRuntime {
     }
     return { options: { version: "2" }, trace: new BuildKitTraceDecoder() };
   }
+  /**
+   * Bind legacy-builder cleanup to the exact container id Docker announces in
+   * this build's own progress stream. A 404 is an ordinary "already cleaned"
+   * result; every other inspection failure remains inconclusive and therefore
+   * can never authorize a kill.
+   */
+  legacyBuildContainerTracker(expectedMemoryBytes, ownershipHost) {
+    return new LegacyBuildContainerTracker(
+      {
+        inspect: async (id) => {
+          try {
+            return await this.docker.getContainer(id).inspect();
+          } catch (error) {
+            if (isDockerNotFoundError(error)) return null;
+            throw error;
+          }
+        },
+        kill: async (id) => {
+          await this.docker.getContainer(id).kill({ signal: "SIGKILL" });
+        }
+      },
+      expectedMemoryBytes,
+      ownershipHost
+    );
+  }
+  /** Same proof model as the Engine-API tracker, using the already-live SSH executor. */
+  remoteLegacyBuildContainerTracker(executor, ownershipHost) {
+    return new LegacyBuildContainerTracker(
+      {
+        inspect: async (id) => {
+          try {
+            const output = await executor.exec(`docker container inspect ${sq(id)}`);
+            const parsed = JSON.parse(output);
+            return Array.isArray(parsed) && parsed[0] && typeof parsed[0] === "object" ? parsed[0] : null;
+          } catch (error) {
+            if (/No such (?:object|container)|not found/i.test(safeErrorMessage(error)))
+              return null;
+            throw error;
+          }
+        },
+        kill: async (id) => {
+          await executor.exec(`docker container kill --signal KILL ${sq(id)} >/dev/null`);
+        }
+      },
+      // The native CLI path intentionally applies no OpenShip memory flag.
+      void 0,
+      ownershipHost
+    );
+  }
   /**
    * Dockerode build path. Used for local socket and TCP transports, plus
    * SSH transports that didn't get an executor wired in (shouldn't happen
@@ -6618,13 +7026,21 @@ var DockerRuntime = class _DockerRuntime {
    */
   async buildViaDockerode(config, buildContext, tag, log, cancelSignal) {
     log.log(`Streaming build context to Docker daemon - image tag: ${tag}`);
-    const { body, abortSignal, takeError } = packBuildContext(
+    const { body, abortSignal, abort, detachCancellation, takeError } = packBuildContext(
       buildContext.buildContextDir,
       buildContext.contextEntries,
       cancelSignal,
       buildContext.ignoreContextPath
     );
     const builder = this.selectDockerodeBuilder(config, buildContext.requiresBuildKit, log);
+    const buildLimits = dockerBuildResourceLimits(config.resources);
+    const ownershipHost = builder.options.version !== "2" ? newBuildOwnershipHost() : null;
+    const diagnosticContext = {
+      configuredMemoryMb: config.resources.memoryMb,
+      // Engine API build limits work only with the classic builder. The
+      // BuildKit selection above already logs that its build runs uncapped.
+      memoryLimitApplied: builder.options.version !== "2" && buildLimits.memory !== void 0
+    };
     try {
       const stream = await this.docker.buildImage(body, {
         t: tag,
@@ -6634,13 +7050,23 @@ var DockerRuntime = class _DockerRuntime {
         // Omitted entirely unless the project set a build cap — a self-hosted
         // build should be free to use the machine (a production build often
         // needs several GB). Opt-in only; see dockerBuildResourceLimits.
-        ...dockerBuildResourceLimits(config.resources),
+        ...buildLimits,
+        ...ownershipHost && { extrahosts: `${ownershipHost}:127.0.0.1` },
         forcerm: true,
         ...builder.options,
         abortSignal
       });
+      detachCancellation();
       log.log("Connected to Docker daemon. Build output follows:");
-      await this.streamDockerodeBuild(stream, log, builder.trace);
+      await this.streamDockerodeBuild(stream, log, {
+        trace: builder.trace,
+        diagnosticContext,
+        abortBuild: abort,
+        cancelSignal,
+        ...ownershipHost && {
+          legacyBuilder: { expectedMemoryBytes: buildLimits.memory, ownershipHost }
+        }
+      });
       log.log("Docker daemon finished streaming build output. Finalizing image...\n");
     } catch (err) {
       const contextErr = takeError();
@@ -6648,6 +7074,7 @@ var DockerRuntime = class _DockerRuntime {
         cause: contextErr
       }) : err;
     } finally {
+      detachCancellation();
       await buildContext.cleanup();
     }
   }
@@ -6656,71 +7083,116 @@ var DockerRuntime = class _DockerRuntime {
    * idle timeout + keepalive, and throw on a fatal build event. Shared by the
    * single-image dockerode path and the local batch build (buildImages).
    */
-  async streamDockerodeBuild(stream, log, trace) {
+  async streamDockerodeBuild(stream, log, options = {}) {
     let fatalBuildError = null;
-    await new Promise((resolve, reject) => {
-      let settled = false;
-      let idleTimer = null;
-      let keepaliveTimer = null;
-      let idleMinutes = 0;
-      const clearTimers = () => {
-        if (idleTimer) {
-          clearTimeout(idleTimer);
-          idleTimer = null;
-        }
-        if (keepaliveTimer) {
-          clearInterval(keepaliveTimer);
-          keepaliveTimer = null;
-        }
-        idleMinutes = 0;
-      };
-      const fail = (error) => {
-        if (settled) return;
-        settled = true;
-        clearTimers();
-        stream.destroy?.(error);
-        reject(error);
-      };
-      const succeed = () => {
-        if (settled) return;
-        settled = true;
-        clearTimers();
-        resolve();
-      };
-      const resetIdleTimer = () => {
-        clearTimers();
-        keepaliveTimer = setInterval(() => {
-          idleMinutes += 1;
-          log.log(`Still building... (no output for ${idleMinutes}m)`);
-        }, 6e4);
-        if (keepaliveTimer.unref) keepaliveTimer.unref();
-        idleTimer = setTimeout(() => {
-          fail(
-            new Error(
-              "Docker build produced no output for 30 minutes. This usually means the remote server cannot reach the package registry, has broken DNS, or the Docker daemon stalled during the build."
-            )
+    let streamedFailureHint = null;
+    const timeoutMs = getDockerBuildIdleTimeoutMs();
+    const diagnosticContext = options.diagnosticContext ?? {};
+    const buildContainerTracker = options.legacyBuilder ? this.legacyBuildContainerTracker(
+      options.legacyBuilder.expectedMemoryBytes,
+      options.legacyBuilder.ownershipHost
+    ) : null;
+    let inactivityTimedOut = false;
+    try {
+      await new Promise((resolve, reject) => {
+        let settled = false;
+        let idleMonitor = null;
+        let cancellationTimer = null;
+        const clearTimers = () => {
+          idleMonitor?.stop();
+          if (cancellationTimer) clearTimeout(cancellationTimer);
+          options.cancelSignal?.removeEventListener("abort", requestCancellation);
+        };
+        const fail = (error) => {
+          if (settled) return;
+          settled = true;
+          clearTimers();
+          stream.destroy?.(error);
+          reject(error);
+        };
+        const abortCancelledBuild = () => {
+          if (settled) return;
+          buildContainerTracker?.flush();
+          if (buildContainerTracker) void buildContainerTracker.terminateActive();
+          const error = new BuildCancelledError();
+          fail(error);
+          options.abortBuild?.(error);
+        };
+        const requestCancellation = () => {
+          if (settled || cancellationTimer) return;
+          idleMonitor?.stop();
+          cancellationTimer = setTimeout(
+            abortCancelledBuild,
+            buildContainerTracker ? BUILD_CONTAINER_IDENTIFICATION_GRACE_MS : 0
           );
-        }, DOCKER_BUILD_IDLE_TIMEOUT_MS);
-        if (idleTimer.unref) idleTimer.unref();
-      };
-      resetIdleTimer();
-      this.docker.modem.followProgress(
-        stream,
-        (err) => {
-          if (err) {
-            fail(err);
+          cancellationTimer.unref?.();
+        };
+        const succeed = () => {
+          if (settled) return;
+          if (options.cancelSignal?.aborted) {
+            abortCancelledBuild();
             return;
           }
-          succeed();
-        },
-        (event) => {
-          resetIdleTimer();
-          fatalBuildError ??= this.handleBuildEvent(event, log, trace);
-        }
+          settled = true;
+          clearTimers();
+          resolve();
+        };
+        idleMonitor = startDockerBuildIdleMonitor({
+          timeoutMs,
+          onIdle: (idleMs) => {
+            log.log(`Still building... (no output for ${Math.floor(idleMs / 6e4)}m)`);
+          },
+          onTimeout: () => {
+            const error = dockerBuildIdleTimeoutError(timeoutMs, diagnosticContext);
+            inactivityTimedOut = true;
+            if (buildContainerTracker) {
+              void buildContainerTracker.terminateActive();
+            }
+            fail(error);
+            options.abortBuild?.(error);
+          }
+        });
+        if (options.cancelSignal?.aborted) requestCancellation();
+        else options.cancelSignal?.addEventListener("abort", requestCancellation, { once: true });
+        this.docker.modem.followProgress(
+          stream,
+          (err) => {
+            if (err) {
+              fail(err);
+              return;
+            }
+            succeed();
+          },
+          (event) => {
+            idleMonitor?.progress();
+            buildContainerTracker?.observe(event.stream);
+            const diagnostics = this.handleBuildEvent(event, log, options.trace, diagnosticContext);
+            fatalBuildError ??= diagnostics?.errorMessage ?? null;
+            streamedFailureHint = chooseDockerBuildFailureHint(
+              streamedFailureHint,
+              diagnostics?.failureHint ?? null
+            );
+          }
+        );
+      });
+    } catch (error) {
+      await stopTrackedBuildContainer(
+        buildContainerTracker,
+        log,
+        inactivityTimedOut ? "timed-out" : "interrupted"
       );
-    });
+      throw error;
+    }
+    if (options.cancelSignal?.aborted) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw new BuildCancelledError();
+    }
     if (fatalBuildError) {
-      throw new Error(fatalBuildError);
+      const hint = chooseDockerBuildFailureHint(fatalBuildError, streamedFailureHint);
+      throw new Error(
+        hint && !hint.includes(fatalBuildError) ? `${fatalBuildError}
+${hint}` : hint ?? fatalBuildError
+      );
     }
   }
   /**
@@ -7445,13 +7917,19 @@ var DockerRuntime = class _DockerRuntime {
               { signal, requiresBuildKit }
             );
           } else {
-            const { body, abortSignal, takeError } = packBuildContext(
+            const { body, abortSignal, abort, detachCancellation, takeError } = packBuildContext(
               buildContextDir ?? tree.contextDir,
               contextEntries ?? [],
               signal,
               ignoreContextPath
             );
             const builder = this.selectDockerodeBuilder(spec.config, requiresBuildKit, spec.logger);
+            const buildLimits = dockerBuildResourceLimits(spec.config.resources);
+            const ownershipHost = builder.options.version !== "2" ? newBuildOwnershipHost() : null;
+            const diagnosticContext = {
+              configuredMemoryMb: spec.config.resources.memoryMb,
+              memoryLimitApplied: builder.options.version !== "2" && buildLimits.memory !== void 0
+            };
             try {
               const stream = await this.docker.buildImage(body, {
                 t: tag,
@@ -7461,18 +7939,30 @@ var DockerRuntime = class _DockerRuntime {
                   sessionId: spec.config.sessionId
                 }),
                 buildargs: resolveDockerBuildArgs(spec.config),
-                ...dockerBuildResourceLimits(spec.config.resources),
+                ...buildLimits,
+                ...ownershipHost && { extrahosts: `${ownershipHost}:127.0.0.1` },
                 forcerm: true,
                 ...builder.options,
                 abortSignal
               });
-              await this.streamDockerodeBuild(stream, spec.logger, builder.trace);
+              detachCancellation();
+              await this.streamDockerodeBuild(stream, spec.logger, {
+                trace: builder.trace,
+                diagnosticContext,
+                abortBuild: abort,
+                cancelSignal: signal,
+                ...ownershipHost && {
+                  legacyBuilder: { expectedMemoryBytes: buildLimits.memory, ownershipHost }
+                }
+              });
             } catch (err) {
               const contextErr = takeError();
               throw contextErr ? new Error(
                 `Failed to read Docker build context: ${safeErrorMessage(contextErr)}`,
                 { cause: contextErr }
               ) : err;
+            } finally {
+              detachCancellation();
             }
           }
           if (isCancelled(spec.config.sessionId)) {
@@ -7792,6 +8282,56 @@ var DockerRuntime = class _DockerRuntime {
     } catch {
     }
   }
+  /**
+   * Reclaim BuildKit/classic-builder cache through Docker Engine's native API.
+   *
+   * Build cache belongs to the DAEMON, not to a project: intermediate records
+   * do not reliably retain OpenShip's final-image labels. Callers therefore own
+   * the host-wide policy (bounded automatic retention vs an explicit full
+   * clear). Docker itself excludes records leased by an active build.
+   *
+   * dockerode 4.0.9's `pruneBuilder(opts)` silently discards `opts`, so use its
+   * modem directly until upstream forwards the query parameters.
+   */
+  async pruneBuildCache(options = {}) {
+    const keepStorageBytes = options.keepStorageBytes;
+    if (keepStorageBytes !== void 0 && (!Number.isSafeInteger(keepStorageBytes) || keepStorageBytes < 0)) {
+      throw new RangeError("keepStorageBytes must be a non-negative safe integer");
+    }
+    const query = {
+      all: options.all ?? false
+    };
+    if (keepStorageBytes !== void 0) query["keep-storage"] = keepStorageBytes;
+    if (options.filters && Object.keys(options.filters).length > 0) {
+      query.filters = options.filters;
+    }
+    const raw = await new Promise((resolve, reject) => {
+      this.docker.modem.dial(
+        {
+          path: "/build/prune?",
+          method: "POST",
+          // `_body: {}` prevents docker-modem from serializing the query object
+          // into an irrelevant POST body while preserving its normal query
+          // encoding (including JSON-encoded filter maps).
+          options: { _query: query, _body: {} },
+          abortSignal: options.abortSignal,
+          statusCodes: {
+            200: true,
+            500: "server error"
+          }
+        },
+        (err, data) => {
+          if (err) reject(err);
+          else resolve(data);
+        }
+      );
+    });
+    const response = raw ?? {};
+    return {
+      cachesDeleted: Array.isArray(response.CachesDeleted) ? response.CachesDeleted.filter((id) => typeof id === "string") : [],
+      spaceReclaimed: typeof response.SpaceReclaimed === "number" && Number.isFinite(response.SpaceReclaimed) && response.SpaceReclaimed >= 0 ? response.SpaceReclaimed : 0
+    };
+  }
   /**
    * Containers labeled for this deployment, with live state — the reconcile
    * read-back. `State` is dockerode's `running | exited | paused | ...`; map it